iec-builder 0.1.0

package/src/services/db-whitelist.test.ts

@@ -0,0 +1,671 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const {
+  mockInsertOne,
+  mockFindOne,
+  mockUpdateOne,
+  mockCountDocuments,
+  mockToArray,
+  mockSort,
+  mockFind,
+  mockEnsureMongoUser,
+  mockExecFileSync,
+} = vi.hoisted(() => {
+  const mockInsertOne = vi.fn()
+  const mockFindOne = vi.fn()
+  const mockUpdateOne = vi.fn()
+  const mockCountDocuments = vi.fn(() => 0)
+  const mockToArray = vi.fn(() => [])
+  const mockSort = vi.fn(() => ({ toArray: mockToArray }))
+  const mockFind = vi.fn(() => ({ sort: mockSort, toArray: mockToArray }))
+  const mockEnsureMongoUser = vi.fn(() => true)
+  const mockExecFileSync = vi.fn()
+  return {
+    mockInsertOne, mockFindOne, mockUpdateOne, mockCountDocuments,
+    mockToArray, mockSort, mockFind, mockEnsureMongoUser, mockExecFileSync,
+  }
+})
+
+vi.mock('../config/env.js', () => ({
+  env: {
+    DB_MONGODB_HOST: '64.23.181.20',
+    DB_MONGODB_PUBLIC_HOST: '64.23.181.20',
+    DB_MONGODB_PORT: 27017,
+    DB_MONGODB_ADMIN_URI: 'mongodb://admin:pass@localhost:27017/admin',
+  },
+}))
+
+vi.mock('../utils/logger.js', () => ({
+  logger: {
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+  },
+}))
+
+vi.mock('./crypto.js', () => ({
+  encrypt: vi.fn((v: string) => `encrypted:${v}`),
+  decrypt: vi.fn((v: string) => v.replace('encrypted:', '')),
+}))
+
+vi.mock('./database.js', () => ({
+  getDbWhitelistCollection: vi.fn(() => ({
+    insertOne: mockInsertOne,
+    findOne: mockFindOne,
+    find: mockFind,
+    updateOne: mockUpdateOne,
+    countDocuments: mockCountDocuments,
+  })),
+  getServicesCollection: vi.fn(() => ({
+    updateOne: vi.fn(),
+  })),
+}))
+
+vi.mock('./db-credential-manager.js', () => ({
+  buildMongoUsername: vi.fn((svc: string, env: string) => `svc_${svc}_${env}`),
+  generatePassword: vi.fn(() => 'test-password-abc123'),
+  ensureMongoUser: mockEnsureMongoUser,
+}))
+
+vi.mock('child_process', () => ({
+  execFileSync: mockExecFileSync,
+}))
+
+import {
+  validatePublicIp,
+  detectCallerIp,
+  isIpsetAvailable,
+  addIpToSet,
+  removeIpFromSet,
+  createWhitelistEntry,
+  revokeWhitelistEntry,
+  listWhitelistEntries,
+  listAllWhitelistEntries,
+  reconcileOnStartup,
+} from './db-whitelist.js'
+import { logger } from '../utils/logger.js'
+import { decrypt } from './crypto.js'
+import type { Service } from '../models/types.js'
+
+function makeService(overrides: Partial<Service> = {}): Service {
+  return {
+    id: 'svc-001',
+    name: 'my-api',
+    repoUrl: 'https://git.insureco.io/insureco/my-api.git',
+    branch: 'main',
+    dockerfilePath: 'Dockerfile',
+    webhookSecret: 'secret',
+    org: 'insureco',
+    createdAt: '2026-01-01T00:00:00Z',
+    updatedAt: '2026-01-01T00:00:00Z',
+    databaseCredentials: [
+      {
+        type: 'mongodb',
+        username: 'svc_my-api_prod',
+        passwordEncrypted: 'encrypted:prod-pass-123',
+        databaseName: 'my-api-prod',
+        environment: 'prod',
+        provisionedAt: '2026-01-01T00:00:00Z',
+      },
+    ],
+    ...overrides,
+  } as Service
+}
+
+// =============================================================================
+// Tests
+// =============================================================================
+
+describe('db-whitelist', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    // Default: ipset not available (dev mode)
+    mockExecFileSync.mockImplementation(() => {
+      throw new Error('command not found')
+    })
+  })
+
+  // ---------------------------------------------------------------------------
+  // validatePublicIp
+  // ---------------------------------------------------------------------------
+  describe('validatePublicIp', () => {
+    it('should accept valid public IPv4 addresses', () => {
+      expect(validatePublicIp('73.162.55.10')).toEqual({ valid: true })
+      expect(validatePublicIp('8.8.8.8')).toEqual({ valid: true })
+      expect(validatePublicIp('203.0.113.1')).toEqual({ valid: true })
+    })
+
+    it('should reject private IPs (10.x.x.x)', () => {
+      const result = validatePublicIp('10.0.0.1')
+      expect(result.valid).toBe(false)
+      expect(result.reason).toContain('RFC 1918')
+    })
+
+    it('should reject private IPs (172.16-31.x.x)', () => {
+      expect(validatePublicIp('172.16.0.1').valid).toBe(false)
+      expect(validatePublicIp('172.20.0.1').valid).toBe(false)
+      expect(validatePublicIp('172.31.255.255').valid).toBe(false)
+    })
+
+    it('should reject private IPs (192.168.x.x)', () => {
+      const result = validatePublicIp('192.168.1.1')
+      expect(result.valid).toBe(false)
+      expect(result.reason).toContain('RFC 1918')
+    })
+
+    it('should reject loopback (127.x.x.x)', () => {
+      const result = validatePublicIp('127.0.0.1')
+      expect(result.valid).toBe(false)
+      expect(result.reason).toContain('loopback')
+    })
+
+    it('should reject link-local (169.254.x.x)', () => {
+      const result = validatePublicIp('169.254.1.1')
+      expect(result.valid).toBe(false)
+      expect(result.reason).toContain('link-local')
+    })
+
+    it('should reject invalid format', () => {
+      expect(validatePublicIp('not-an-ip').valid).toBe(false)
+      expect(validatePublicIp('').valid).toBe(false)
+      expect(validatePublicIp('1.2.3').valid).toBe(false)
+      expect(validatePublicIp('1.2.3.4.5').valid).toBe(false)
+    })
+
+    it('should reject octets > 255', () => {
+      const result = validatePublicIp('256.1.1.1')
+      expect(result.valid).toBe(false)
+      expect(result.reason).toContain('out of range')
+    })
+
+    it('should reject 0.x.x.x', () => {
+      const result = validatePublicIp('0.0.0.0')
+      expect(result.valid).toBe(false)
+      expect(result.reason).toContain('invalid')
+    })
+  })
+
+  // ---------------------------------------------------------------------------
+  // detectCallerIp
+  // ---------------------------------------------------------------------------
+  describe('detectCallerIp', () => {
+    it('should prefer CF-Connecting-IP header', () => {
+      const headers = {
+        'cf-connecting-ip': '73.162.55.10',
+        'x-forwarded-for': '98.45.0.1, 10.0.0.1',
+      }
+      expect(detectCallerIp(headers)).toBe('73.162.55.10')
+    })
+
+    it('should fall back to first X-Forwarded-For entry', () => {
+      const headers = { 'x-forwarded-for': '73.162.55.10, 10.0.0.1' }
+      expect(detectCallerIp(headers)).toBe('73.162.55.10')
+    })
+
+    it('should trim whitespace from IP', () => {
+      const headers = { 'cf-connecting-ip': '  73.162.55.10  ' }
+      expect(detectCallerIp(headers)).toBe('73.162.55.10')
+    })
+
+    it('should use fallback IP when no headers present', () => {
+      expect(detectCallerIp({}, '98.45.0.1')).toBe('98.45.0.1')
+    })
+
+    it('should return undefined when no IP available', () => {
+      expect(detectCallerIp({})).toBeUndefined()
+    })
+
+    it('should ignore empty CF-Connecting-IP', () => {
+      const headers = { 'cf-connecting-ip': '', 'x-forwarded-for': '73.162.55.10' }
+      expect(detectCallerIp(headers)).toBe('73.162.55.10')
+    })
+  })
+
+  // ---------------------------------------------------------------------------
+  // isIpsetAvailable / addIpToSet / removeIpFromSet
+  // ---------------------------------------------------------------------------
+  describe('isIpsetAvailable', () => {
+    it('should return true when ipset command succeeds', () => {
+      mockExecFileSync.mockReturnValueOnce('ipset v7.15')
+      expect(isIpsetAvailable()).toBe(true)
+    })
+
+    it('should return false when ipset command fails', () => {
+      expect(isIpsetAvailable()).toBe(false)
+    })
+  })
+
+  describe('addIpToSet', () => {
+    it('should call execFileSync with correct args and return true', () => {
+      mockExecFileSync.mockReturnValueOnce('')
+      const result = addIpToSet('73.162.55.10', 28800)
+      expect(result).toBe(true)
+      expect(mockExecFileSync).toHaveBeenCalledWith(
+        'sudo',
+        ['ipset', 'add', 'mongodb-access', '73.162.55.10', 'timeout', '28800', '-exist'],
+        { encoding: 'utf8', stdio: 'pipe' }
+      )
+      expect(logger.info).toHaveBeenCalled()
+    })
+
+    it('should return false on failure', () => {
+      const result = addIpToSet('73.162.55.10', 28800)
+      expect(result).toBe(false)
+      expect(logger.error).toHaveBeenCalled()
+    })
+  })
+
+  describe('removeIpFromSet', () => {
+    it('should call execFileSync with correct args and return true', () => {
+      mockExecFileSync.mockReturnValueOnce('')
+      const result = removeIpFromSet('73.162.55.10')
+      expect(result).toBe(true)
+      expect(mockExecFileSync).toHaveBeenCalledWith(
+        'sudo',
+        ['ipset', 'del', 'mongodb-access', '73.162.55.10', '-exist'],
+        { encoding: 'utf8', stdio: 'pipe' }
+      )
+    })
+
+    it('should return false on failure', () => {
+      const result = removeIpFromSet('73.162.55.10')
+      expect(result).toBe(false)
+      expect(logger.error).toHaveBeenCalled()
+    })
+  })
+
+  // ---------------------------------------------------------------------------
+  // createWhitelistEntry
+  // ---------------------------------------------------------------------------
+  describe('createWhitelistEntry', () => {
+    it('should create entry with readWrite access using existing credentials', async () => {
+      const service = makeService()
+      const result = await createWhitelistEntry(
+        service, '73.162.55.10', 'prod', 'readWrite', 8, 'user-1', 'dev@insureco.io'
+      )
+
+      expect(result.ip).toBe('73.162.55.10')
+      expect(result.environment).toBe('prod')
+      expect(result.accessLevel).toBe('readWrite')
+      expect(result.connectionString).toContain('svc_my-api_prod')
+      expect(result.connectionString).toContain('prod-pass-123')
+      expect(result.connectionString).toContain('64.23.181.20:27017')
+      expect(result.connectionString).toContain('my-api-prod')
+      expect(result.connectionString).toContain('authSource=my-api-prod')
+      expect(result.id).toBeDefined()
+      expect(result.expiresAt).toBeDefined()
+      expect(mockInsertOne).toHaveBeenCalledTimes(1)
+    })
+
+    it('should create entry with read access and provision _ro user', async () => {
+      const service = makeService()
+      const result = await createWhitelistEntry(
+        service, '73.162.55.10', 'prod', 'read', 8, 'user-1', 'dev@insureco.io'
+      )
+
+      expect(result.accessLevel).toBe('read')
+      expect(mockEnsureMongoUser).toHaveBeenCalledWith(
+        'my-api-prod', 'svc_my-api_prod_ro', 'test-password-abc123', 'read'
+      )
+      expect(result.connectionString).toContain('svc_my-api_prod_ro')
+    })
+
+    it('should use existing _ro credential without re-provisioning', async () => {
+      const service = makeService({
+        databaseCredentials: [
+          {
+            type: 'mongodb',
+            username: 'svc_my-api_prod',
+            passwordEncrypted: 'encrypted:prod-pass-123',
+            databaseName: 'my-api-prod',
+            environment: 'prod',
+            provisionedAt: '2026-01-01T00:00:00Z',
+          },
+          {
+            type: 'mongodb',
+            username: 'svc_my-api_prod_ro',
+            passwordEncrypted: 'encrypted:ro-pass-456',
+            databaseName: 'my-api-prod',
+            environment: 'prod',
+            provisionedAt: '2026-01-01T00:00:00Z',
+          },
+        ],
+      })
+
+      const result = await createWhitelistEntry(
+        service, '73.162.55.10', 'prod', 'read', 8, 'user-1', 'dev@insureco.io'
+      )
+
+      expect(mockEnsureMongoUser).not.toHaveBeenCalled()
+      expect(result.connectionString).toContain('svc_my-api_prod_ro')
+      expect(result.connectionString).toContain('ro-pass-456')
+    })
+
+    it('should clamp TTL to minimum 1 hour', async () => {
+      const service = makeService()
+      const result = await createWhitelistEntry(
+        service, '73.162.55.10', 'prod', 'readWrite', 0, 'user-1', 'dev@insureco.io'
+      )
+
+      const diffMs = new Date(result.expiresAt).getTime() - Date.now()
+      const diffHours = diffMs / 3600000
+      expect(diffHours).toBeGreaterThan(0.9)
+      expect(diffHours).toBeLessThan(1.2)
+    })
+
+    it('should clamp TTL to maximum 24 hours', async () => {
+      const service = makeService()
+      const result = await createWhitelistEntry(
+        service, '73.162.55.10', 'prod', 'readWrite', 48, 'user-1', 'dev@insureco.io'
+      )
+
+      const diffMs = new Date(result.expiresAt).getTime() - Date.now()
+      const diffHours = diffMs / 3600000
+      expect(diffHours).toBeGreaterThan(23.8)
+      expect(diffHours).toBeLessThan(24.2)
+    })
+
+    it('should throw when service has no MongoDB database configured', async () => {
+      const service = makeService({ databaseCredentials: [] })
+      await expect(
+        createWhitelistEntry(service, '73.162.55.10', 'prod', 'readWrite', 8, 'user-1', 'dev@insureco.io')
+      ).rejects.toThrow('has no MongoDB database configured')
+    })
+
+    it('should throw when readWrite credentials not available for environment', async () => {
+      // Has prod _ro cred (db name resolves) but no prod readWrite cred,
+      // AND lazy provisioning fails
+      mockEnsureMongoUser.mockResolvedValueOnce(false)
+      const service = makeService({
+        databaseCredentials: [{
+          type: 'mongodb',
+          username: 'svc_my-api_prod_ro',
+          passwordEncrypted: 'encrypted:ro-pass',
+          databaseName: 'my-api-prod',
+          environment: 'prod',
+          provisionedAt: '2026-01-01T00:00:00Z',
+        }],
+      })
+      await expect(
+        createWhitelistEntry(service, '73.162.55.10', 'prod', 'readWrite', 8, 'user-1', 'dev@insureco.io')
+      ).rejects.toThrow('No readWrite credentials available')
+    })
+
+    it('should throw when read provisioning fails', async () => {
+      mockEnsureMongoUser.mockResolvedValueOnce(false)
+      const service = makeService()
+      await expect(
+        createWhitelistEntry(service, '73.162.55.10', 'prod', 'read', 8, 'user-1', 'dev@insureco.io')
+      ).rejects.toThrow('No read credentials available')
+    })
+
+    it('should skip ipset when unavailable (dev mode)', async () => {
+      const service = makeService()
+      await createWhitelistEntry(
+        service, '73.162.55.10', 'prod', 'readWrite', 8, 'user-1', 'dev@insureco.io'
+      )
+      expect(logger.warn).toHaveBeenCalledWith(expect.stringContaining('ipset not available'))
+    })
+
+    it('should add IP to ipset when available', async () => {
+      mockExecFileSync.mockReturnValue('')
+      const service = makeService()
+      await createWhitelistEntry(
+        service, '73.162.55.10', 'prod', 'readWrite', 8, 'user-1', 'dev@insureco.io'
+      )
+
+      expect(mockExecFileSync).toHaveBeenCalledWith(
+        'sudo',
+        expect.arrayContaining(['ipset', 'add', 'mongodb-access', '73.162.55.10']),
+        expect.any(Object)
+      )
+    })
+
+    it('should throw when ipset add fails', async () => {
+      mockExecFileSync
+        .mockReturnValueOnce('ipset v7.15')
+        .mockImplementationOnce(() => { throw new Error('ipset add failed') })
+
+      const service = makeService()
+      await expect(
+        createWhitelistEntry(service, '73.162.55.10', 'prod', 'readWrite', 8, 'user-1', 'dev@insureco.io')
+      ).rejects.toThrow('Failed to add IP to firewall whitelist')
+    })
+
+    it('should insert audit record with correct fields', async () => {
+      const service = makeService()
+      await createWhitelistEntry(
+        service, '73.162.55.10', 'prod', 'readWrite', 8, 'user-1', 'dev@insureco.io'
+      )
+
+      expect(mockInsertOne).toHaveBeenCalledTimes(1)
+      const doc = mockInsertOne.mock.calls[0][0]
+      expect(doc.serviceId).toBe('svc-001')
+      expect(doc.serviceName).toBe('my-api')
+      expect(doc.orgId).toBe('insureco')
+      expect(doc.ip).toBe('73.162.55.10')
+      expect(doc.environment).toBe('prod')
+      expect(doc.accessLevel).toBe('readWrite')
+      expect(doc.requestedBy).toBe('user-1')
+      expect(doc.requestedByEmail).toBe('dev@insureco.io')
+      expect(doc.status).toBe('active')
+      expect(doc.expiresAt).toBeInstanceOf(Date)
+      expect(typeof doc.createdAt).toBe('string')
+    })
+
+    it('should resolve db name from catalogSpec when available', async () => {
+      const service = {
+        ...makeService(),
+        catalogSpec: { databases: [{ type: 'mongodb', name: 'custom-db' }] },
+      } as unknown as Service
+
+      const result = await createWhitelistEntry(
+        service, '73.162.55.10', 'prod', 'readWrite', 8, 'user-1', 'dev@insureco.io'
+      )
+
+      expect(result.connectionString).toContain('custom-db')
+    })
+
+    it('should fall back to databaseCredentials for db name', async () => {
+      const service = makeService()
+      const result = await createWhitelistEntry(
+        service, '73.162.55.10', 'prod', 'readWrite', 8, 'user-1', 'dev@insureco.io'
+      )
+      expect(result.connectionString).toContain('my-api-prod')
+    })
+
+    it('should URL-encode special characters in credentials', async () => {
+      const service = makeService({
+        databaseCredentials: [{
+          type: 'mongodb',
+          username: 'svc_my-api_prod',
+          passwordEncrypted: 'encrypted:p@ss/w0rd?&=',
+          databaseName: 'my-api-prod',
+          environment: 'prod',
+          provisionedAt: '2026-01-01T00:00:00Z',
+        }],
+      })
+
+      const result = await createWhitelistEntry(
+        service, '73.162.55.10', 'prod', 'readWrite', 8, 'user-1', 'dev@insureco.io'
+      )
+
+      expect(result.connectionString).toContain(encodeURIComponent('p@ss/w0rd?&='))
+    })
+
+    it('should return null and log error when decrypt fails for readWrite', async () => {
+      vi.mocked(decrypt).mockImplementationOnce(() => { throw new Error('decrypt failed') })
+      // Lazy provisioning also fails — no fallback
+      mockEnsureMongoUser.mockResolvedValueOnce(false)
+      const service = makeService()
+      await expect(
+        createWhitelistEntry(service, '73.162.55.10', 'prod', 'readWrite', 8, 'user-1', 'dev@insureco.io')
+      ).rejects.toThrow('No readWrite credentials available')
+      expect(logger.error).toHaveBeenCalled()
+    })
+  })
+
+  // ---------------------------------------------------------------------------
+  // revokeWhitelistEntry
+  // ---------------------------------------------------------------------------
+  describe('revokeWhitelistEntry', () => {
+    it('should revoke active entry and mark as revoked', async () => {
+      mockFindOne.mockResolvedValueOnce({
+        id: 'entry-1', ip: '73.162.55.10', serviceName: 'my-api',
+        orgId: 'insureco', status: 'active',
+      })
+
+      const result = await revokeWhitelistEntry('entry-1', 'admin@insureco.io')
+
+      expect(result).not.toBeNull()
+      expect(result!.status).toBe('revoked')
+      expect(result!.revokedBy).toBe('admin@insureco.io')
+      expect(result!.revokedAt).toBeDefined()
+      expect(mockUpdateOne).toHaveBeenCalledWith(
+        { id: 'entry-1' },
+        { $set: expect.objectContaining({ status: 'revoked', revokedBy: 'admin@insureco.io' }) }
+      )
+    })
+
+    it('should return null when entry not found', async () => {
+      mockFindOne.mockResolvedValueOnce(null)
+      const result = await revokeWhitelistEntry('nonexistent', 'admin@insureco.io')
+      expect(result).toBeNull()
+      expect(mockUpdateOne).not.toHaveBeenCalled()
+    })
+
+    it('should enforce org scope when orgId provided', async () => {
+      mockFindOne.mockResolvedValueOnce(null)
+      await revokeWhitelistEntry('entry-1', 'admin@insureco.io', 'insureco')
+      expect(mockFindOne).toHaveBeenCalledWith(
+        expect.objectContaining({ id: 'entry-1', status: 'active', orgId: 'insureco' })
+      )
+    })
+
+    it('should skip org filter when orgId not provided', async () => {
+      mockFindOne.mockResolvedValueOnce(null)
+      await revokeWhitelistEntry('entry-1', 'admin@insureco.io')
+      const filter = mockFindOne.mock.calls[0][0]
+      expect(filter).not.toHaveProperty('orgId')
+    })
+
+    it('should remove IP from ipset only when no other active entries use it', async () => {
+      mockExecFileSync.mockReturnValue('')
+      mockCountDocuments.mockResolvedValueOnce(0)
+      mockFindOne.mockResolvedValueOnce({ id: 'entry-1', ip: '73.162.55.10', status: 'active' })
+
+      await revokeWhitelistEntry('entry-1', 'admin@insureco.io')
+
+      expect(mockExecFileSync).toHaveBeenCalledWith(
+        'sudo',
+        expect.arrayContaining(['ipset', 'del', 'mongodb-access', '73.162.55.10']),
+        expect.any(Object)
+      )
+    })
+
+    it('should NOT remove IP from ipset when other active entries exist', async () => {
+      mockExecFileSync.mockReturnValue('')
+      mockCountDocuments.mockResolvedValueOnce(2)
+      mockFindOne.mockResolvedValueOnce({ id: 'entry-1', ip: '73.162.55.10', status: 'active' })
+
+      await revokeWhitelistEntry('entry-1', 'admin@insureco.io')
+
+      const delCalls = mockExecFileSync.mock.calls.filter(c => c[1]?.includes?.('del'))
+      expect(delCalls).toHaveLength(0)
+    })
+
+    it('should skip ipset when unavailable but still mark as revoked', async () => {
+      mockFindOne.mockResolvedValueOnce({ id: 'entry-1', ip: '73.162.55.10', status: 'active' })
+
+      await revokeWhitelistEntry('entry-1', 'admin@insureco.io')
+
+      expect(mockUpdateOne).toHaveBeenCalled()
+      expect(mockCountDocuments).not.toHaveBeenCalled()
+    })
+  })
+
+  // ---------------------------------------------------------------------------
+  // listWhitelistEntries / listAllWhitelistEntries
+  // ---------------------------------------------------------------------------
+  describe('listWhitelistEntries', () => {
+    it('should filter by serviceName and active status', async () => {
+      await listWhitelistEntries('my-api')
+      expect(mockFind).toHaveBeenCalledWith({ serviceName: 'my-api', status: 'active' })
+    })
+
+    it('should add environment filter when provided', async () => {
+      await listWhitelistEntries('my-api', 'prod')
+      expect(mockFind).toHaveBeenCalledWith({ serviceName: 'my-api', status: 'active', environment: 'prod' })
+    })
+
+    it('should sort by createdAt descending', async () => {
+      await listWhitelistEntries('my-api')
+      expect(mockSort).toHaveBeenCalledWith({ createdAt: -1 })
+    })
+  })
+
+  describe('listAllWhitelistEntries', () => {
+    it('should filter only active entries', async () => {
+      await listAllWhitelistEntries()
+      expect(mockFind).toHaveBeenCalledWith({ status: 'active' })
+    })
+  })
+
+  // ---------------------------------------------------------------------------
+  // reconcileOnStartup
+  // ---------------------------------------------------------------------------
+  describe('reconcileOnStartup', () => {
+    it('should skip when ipset not available', async () => {
+      await reconcileOnStartup()
+      expect(logger.info).toHaveBeenCalledWith(expect.stringContaining('ipset not available'))
+      expect(mockFind).not.toHaveBeenCalled()
+    })
+
+    it('should re-add active entries with remaining TTL', async () => {
+      mockExecFileSync.mockReturnValue('')
+      const futureDate = new Date(Date.now() + 3600000)
+      mockToArray.mockResolvedValueOnce([
+        { ip: '73.162.55.10', expiresAt: futureDate, status: 'active' },
+        { ip: '98.45.0.1', expiresAt: futureDate, status: 'active' },
+      ])
+
+      await reconcileOnStartup()
+
+      const addCalls = mockExecFileSync.mock.calls.filter(c => c[1]?.includes?.('add'))
+      expect(addCalls).toHaveLength(2)
+      expect(logger.info).toHaveBeenCalledWith(
+        expect.objectContaining({ reconciled: 2, expired: 0, total: 2 }),
+        expect.any(String)
+      )
+    })
+
+    it('should skip expired entries', async () => {
+      mockExecFileSync.mockReturnValue('')
+      mockToArray.mockResolvedValueOnce([
+        { ip: '73.162.55.10', expiresAt: new Date(Date.now() - 3600000), status: 'active' },
+        { ip: '98.45.0.1', expiresAt: new Date(Date.now() + 3600000), status: 'active' },
+      ])
+
+      await reconcileOnStartup()
+
+      const addCalls = mockExecFileSync.mock.calls.filter(c => c[1]?.includes?.('add'))
+      expect(addCalls).toHaveLength(1)
+      expect(logger.info).toHaveBeenCalledWith(
+        expect.objectContaining({ reconciled: 1, expired: 1, total: 2 }),
+        expect.any(String)
+      )
+    })
+
+    it('should handle empty active entries', async () => {
+      mockExecFileSync.mockReturnValue('')
+      mockToArray.mockResolvedValueOnce([])
+
+      await reconcileOnStartup()
+
+      expect(logger.info).toHaveBeenCalledWith(
+        expect.objectContaining({ reconciled: 0, expired: 0, total: 0 }),
+        expect.any(String)
+      )
+    })
+  })
+})